Cyber Posture

CVE-2025-11292

MediumPublic PoC

Published: 05 October 2025

Published
05 October 2025
Modified
29 April 2026
KEV Added
—
Patch
—
CVSS Score 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0024 46.8th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

Security Summary

CVE-2025-11292 is a command injection vulnerability affecting the Belkin F9K1015 router running firmware version 1.00.10. The flaw resides in an unknown function within the /goform/formBSSetSitesurvey CGI endpoint, where manipulation of the wan_ipaddr argument enables arbitrary command execution. It is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component) and CWE-77 (Command Injection), with a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

The vulnerability can be exploited remotely by an attacker with low privileges, such as an authenticated user on the device. Successful exploitation allows limited impacts, including low-level disclosure of confidential information, modification of data, and denial of service through partial availability disruption. A proof-of-concept exploit is publicly available, facilitating potential attacks against exposed Belkin F9K1015 devices.

No vendor response or patch has been issued despite early disclosure notification, as noted in the vulnerability details. Security practitioners should consult the provided references, including the GitHub repository at https://github.com/panda666-888/vuls/blob/main/belkin/f9k1015/formBSSetSitesurvey.md (with POC at the #poc anchor) and VulDB entries (https://vuldb.com/?ctiid.327173, https://vuldb.com/?id.327173, https://vuldb.com/?submit.661295), for reproduction steps and further analysis. Mitigation may involve isolating the device, restricting access to the affected endpoint, or upgrading firmware if a patch becomes available.

The exploit's public availability raises concerns for real-world abuse against unpatched Belkin routers still in use.

Details

CWE(s)
CWE-74CWE-77

Affected Products

belkin
f9k1015 firmware
1.00.10

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.008 Network Device CLI Execution
Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads.
attack.mitre.org →
T1202 Indirect Command Execution Stealth
Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.
attack.mitre.org →
Why these techniques?

Command injection via unauthenticated remote web form on router (/goform/formBSSetSitesurvey, wan_ipaddr) enables initial access by exploiting public-facing application (T1190), indirect command execution (T1202), and network device CLI abuse (T1059.008).

References